HashiCorp Vault Associate (003) Question 93
Single answer3e Explain orphaned tokensA platform team uses Vault to issue short-lived tokens to a CI/CD system. During a maintenance window, an engineer revokes the token that originally created the CI/CD token, but the CI/CD job continues to read secrets successfully until its own TTL expires. The security team wants to understand why revoking the parent token did not immediately remove the child token. Which explanation best describes this behavior?
- A
The CI/CD token is an orphan token, so it has no parent in Vault's token hierarchy and is not revoked when the original creator token is revoked.
- B
The CI/CD token was created with a periodic TTL, which prevents parent-child revocation from applying until the next renewal.
- C
The CI/CD token was created by the token accessor, so revoking the parent token only removes the accessor and not the token itself.
- D
The CI/CD token is a batch token, and batch tokens are automatically converted into root-level tokens when their parent is revoked.
Show answer and explanation
Correct answer: A
Explanation
Vault maintains a token hierarchy for service tokens, where child tokens are normally tied to their parent. In standard behavior, revoking a parent token also revokes its descendants. Orphan tokens are the exception: they are created without a parent relationship, so they survive parent revocation and continue working until their own TTL expires or they are explicitly revoked. In real environments, this matters when teams expect revocation to cascade but are actually using orphan tokens, often created intentionally for operational independence. HashiCorp Vault documentation on token hierarchy and orphan tokens explains that orphaned service tokens are not part of the normal parent-child revocation chain. A candidate should recognize that the observed behavior in this scenario is best explained by the token being orphaned, not by periodic renewal, accessors, or batch-token behavior.
- A. Correct.
Correct. Orphan tokens do not have a parent token in Vault's token hierarchy. Because they are not linked to a parent, revoking the token that created them does not cascade and revoke them. They remain valid until they expire, are explicitly revoked, or are otherwise invalidated. This is the key behavior the scenario is describing.
- B. Incorrect.
Incorrect. Periodic tokens require renewal to continue living, but being periodic does not exempt them from parent-child revocation behavior. If a token has a parent and that parent is revoked, the child token is revoked as well unless the child is orphaned. The misconception here is confusing renewal behavior with token lineage.
- C. Incorrect.
Incorrect. A token accessor is a reference used to look up, renew, or revoke a token without exposing the token value itself. Tokens are not 'created by the accessor,' and revoking a parent token is not limited to removing an accessor. This option mixes up token management concepts.
- D. Incorrect.
Incorrect. Batch tokens are a distinct token type optimized for high-scale ephemeral workloads, but they are not converted into root-level tokens when a parent is revoked. Root tokens are a separate concept entirely. This distractor plays on confusion between token type and token hierarchy.